Katalog CVE (hal. 843)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.301 (Critical 36.664 · High 106.384 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 12:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 42.101–42.150 dari 266.301 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-15411 The StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in...	5.3 Medium	—	0,45%	28 Jul 2026
CVE-2026-15025 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu...	7.5 High	—	0,73%	28 Jul 2026
CVE-2026-13440 The StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scrip...	7.2 High	—	0,46%	28 Jul 2026
CVE-2026-13110 The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check...	5.3 Medium	—	0,40%	28 Jul 2026
CVE-2026-65880 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that...	10.0 Critical	—	0,77%	28 Jul 2026
CVE-2026-63303 A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences befo...	5.1 Medium	—	0,57%	28 Jul 2026
CVE-2026-63302 Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary...	5.1 Medium	—	0,53%	28 Jul 2026
CVE-2026-63301 In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlyin...	7.0 High	—	0,58%	28 Jul 2026
CVE-2026-18029 Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one paymen...	6.3 Medium	—	0,33%	28 Jul 2026
CVE-2026-18028 The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not...	2.3 Low	—	0,35%	28 Jul 2026
CVE-2026-17072 A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or We...	3.3 Low	—	0,12%	28 Jul 2026
CVE-2026-65624 Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over...	6.9 Medium	—	0,38%	28 Jul 2026
CVE-2026-59248 Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server...	8.7 High	—	0,29%	28 Jul 2026
CVE-2026-58246 SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privi...	4.3 Medium	—	0,24%	28 Jul 2026
CVE-2026-16462 In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.	9.8 Critical	—	0,75%	28 Jul 2026
CVE-2026-14785 The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insuffic...	7.5 High	—	0,51%	28 Jul 2026
CVE-2026-14328 The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin...	8.8 High	—	0,73%	28 Jul 2026
CVE-2026-11841 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions...	9.4 Critical	—	0,85%	28 Jul 2026
CVE-2026-11598 The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insuff...	5.0 Medium	—	0,36%	28 Jul 2026
CVE-2026-10207 The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of us...	7.5 High	—	0,51%	28 Jul 2026
CVE-2026-9680 Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint liste...	5.8 Medium	—	0,40%	28 Jul 2026
CVE-2026-8167 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This is...	6.1 Medium	—	0,25%	28 Jul 2026
CVE-2026-61376 ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary...	8.6 High	—	1,7%	28 Jul 2026
CVE-2026-59764 ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command...	8.6 High	—	1,7%	28 Jul 2026
CVE-2026-44387 ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary sc...	5.1 Medium	—	0,24%	28 Jul 2026
CVE-2026-15267 The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in...	6.5 Medium	—	0,43%	28 Jul 2026
CVE-2026-14516 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions...	7.5 High	—	0,48%	28 Jul 2026
CVE-2026-14171 An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a...	6.1 Medium	—	0,31%	28 Jul 2026
CVE-2026-14169 Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which c...	8.1 High	—	0,52%	28 Jul 2026
CVE-2026-14168 A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full sy...	8.8 High	—	0,50%	28 Jul 2026
CVE-2026-14167 A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect author...	8.8 High	—	0,50%	28 Jul 2026
CVE-2026-13161 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all...	7.5 High	—	0,77%	28 Jul 2026
CVE-2026-12800 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/cou...	7.5 High	—	1,6%	28 Jul 2026
CVE-2026-55977 Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcin...	3.3 Low	—	0,13%	28 Jul 2026
CVE-2026-15730 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'hea...	6.4 Medium	—	0,38%	28 Jul 2026
CVE-2026-15673 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment...	4.4 Medium	—	0,52%	28 Jul 2026
CVE-2026-15671 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' paramete...	4.9 Medium	—	0,48%	28 Jul 2026
CVE-2026-15670 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby'...	4.9 Medium	—	0,44%	28 Jul 2026
CVE-2026-15014 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Ta...	9.8 Critical	—	0,89%	28 Jul 2026
CVE-2026-12741 The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to,...	7.5 High	—	1,6%	28 Jul 2026
CVE-2026-11756 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2...	10.0 Critical	—	0,81%	28 Jul 2026
CVE-2024-14041 bouncycastle bc-java In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, wh...	5.9 Medium	—	0,46%	28 Jul 2026
CVE-2026-6251 The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_fi...	6.5 Medium	—	0,41%	28 Jul 2026
CVE-2026-16811 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in al...	4.9 Medium	—	0,44%	28 Jul 2026
CVE-2026-16797 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an...	4.3 Medium	—	0,38%	28 Jul 2026
CVE-2026-16587 The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is...	4.3 Medium	—	0,39%	28 Jul 2026
CVE-2026-16585 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path...	7.2 High	—	1,2%	28 Jul 2026
CVE-2026-15136 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This...	4.3 Medium	—	0,19%	28 Jul 2026
CVE-2026-15012 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 vi...	5.3 Medium	—	0,55%	28 Jul 2026
CVE-2026-14926 The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-meth...	4.2 Medium	—	0,23%	28 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.